Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
Amazon Kiro IDE vulnerability allows data exfiltration via prompt injection and Kiro Powers.
Run Amazon?
Get an email when a reviewed story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A vulnerability in Amazon Kiro, an AI-powered IDE, allows sensitive data exfiltration through prompt injection and Kiro Powers. Attackers can exploit this flaw by tricking users into opening a malicious project, enabling the exfiltration of local information to an external endpoint without explicit user consent. Amazon has released a fix for the vulnerability in version 0.8.140.
The lesson from this incident
Full lessonA prompt injection vulnerability in Amazon Kiro's AI-powered IDE allowed attackers to abuse 'Kiro Powers' — automated AI agent capabilities — to silently exfiltrate sensitive local data to external endpoints simply by tricking a user into opening a malicious project. The root issue lies in insufficient input sanitization and lack of user-consent guardrails around AI agent actions that interact with the local environment. This matters because AI-integrated development tools are rapidly becoming high-value attack surfaces, and developers often trust their IDE environment implicitly, making them prime targets for supply-chain-style social engineering. Amazon has patched the issue in version 0.8.140, but the incident underscores the broader risk of agentic AI systems executing privileged actions without explicit human approval.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.